Kaseya VSA Cross-Site Scripting Vulnerability

Kaseya VSA is the RMM Remote Monitoring and Management software commonly used by Kaseya's Managed Service Providers MSPs in the United States to manage their customers' networks. A cross-site scripting vulnerability exists in Kaseya VSA, which can be exploited by an attacker to execute client-sid...

Kaseya VSA Security Bypass Vulnerability

Kaseya VSA is the RMM Remote Monitoring and Management software commonly used by Kaseya's Managed Service Providers MSPs in the United States to manage their customers' networks. A security vulnerability exists in Kaseya VSA that stems from a 2FA bypass. No details of the vulnerability are provid...

Kaseya VSA Code Injection Vulnerability

Kaseya VSA is the RMM Remote Monitoring and Management software commonly used by Kaseya's Managed Service Providers MSPs in the United States to manage their customers' networks. Kaseya VSA is vulnerable to a code injection vulnerability, no details of the vulnerability are provided at this time...

CVE-2021-30118: Unrestricted Upload of File with Dangerous Type

An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management RMM 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leadin...

Kaseya VSA SQL注入漏洞

Kaseya VSA is the RMM Remote Monitoring and Management software commonly used by Kaseya's Managed Service Providers MSPs in the United States to manage their customers' networks. A SQL injection vulnerability exists in Kaseya VSA versions prior to 9.5.5, which can be exploited by an attacker to...

NinjaRMM has an unspecified vulnerability

NinjaRMM is a remote monitoring and management software from NinjaRMM USA. Improve business efficiency by combining monitoring, alerting, patching, antivirus, backup and IT automation all in a single management platform. NinjaRMM suffers from a security vulnerability that stems from insecure Agen...

NinjaRMM 访问控制错误漏洞

NinjaRMM is a remote monitoring and management software from NinjaRMM USA. Improve business efficiency by combining monitoring, alerting, patching, antivirus, backup and IT automation all in a single management platform. An Access Control Error vulnerability exists in NinjaRMM, which arises from...

CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack

CISA and the Federal Bureau of Investigation FBI continue to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers MSPs and their customers. CISA and FBI strongly urge affected MSPs and their customers to...

Unauthorized Access Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform (CNVD-2021-47700)

Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...

Logic Flaw Vulnerability in Mingguo APT Attack (Cyber Warfare) Warning Platform

Hangzhou ACE Information Technology Co., Ltd. is a company that has been focusing on the research, development, production and sales of products in the field of network information security, such as Fortress, Remote Monitoring, Cloud Saas Service, Cloud WAF, Industrial Control, Online Remote Offi...

Advantech WISE-PaaS/RMM Trust Management Issue Vulnerability

Advantech WISE-PaaS/RMM is a remote monitoring and management platform for IoT devices from Advantech Taiwan, China.Advantech WISE-PaaS/RMM versions prior to 9.0.1 are vulnerable to a trust management issue that stems from the presence of hard-coded credentials in the dashboard. An unauthenticate...

RMM software: What is it and do you need it?

As cybersecurity products evolve to better protect against new forms of malware, trickier evasion techniques, and more organized cybercrime campaigns, the practice of cybersecurity evolves, too, providing simple, streamlined methods to manage hundreds of endpoints through one tool: RMM software...

CVE-2021-27437

The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and password that can be used to query Grafana APIs. Authentication is not required for exploitation on the WISE-PaaS/RMM versions prior to...

Eaton Intelligent Power Manager Eval Injection Vulnerability

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An Eval injection vulnerability exists in Eaton IPM versions prior to 1.69. The vulnerability arises becaus...

Eaton Intelligent Power Manager Arbitrary File Upload Vulnerability

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An arbitrary file upload vulnerability exists in Eaton Intelligent Power Manager IPM versions prior to 1.69...

Eaton Intelligent Power Manager Arbitrary File Deletion Vulnerability (CNVD-2021-31672)

Eaton Intelligent Power Manager IPM is an intelligent power manager from Eaton Corporation that supports remote monitoring and management of multiple devices in a network from an interface. An arbitrary file deletion vulnerability exists in Eaton Intelligent Power Manager versions prior to 1.69,...

Cosori Smart 5.8-Quart Air Fryer CS158-AF configuration server code execution vulnerability

Summary A unauthenticated backdoor exists in the configuration server functionality of Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. Tested Versions Cosori Smart...

CVE-2021-23985

If an attacker is able to alter specific about:config values for example malware running on the user's computer, the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker able to make a direct network...

The vulnerability of the webvrpcs component allows for privilege escalation in the software of the remote monitoring system, Advantech WebAccess. This enables a perpetrator to increase their privileges.

The vulnerability of the webvrpcs component in software for remote monitoring by Advantech WebAccess relates to insecure management of privileges. Exploiting this vulnerability can allow attackers to elevate their own privileges...

CVE-2021-23985

If an attacker is able to alter specific about:config values for example malware running on the user's computer, the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker able to make a direct network...